how to enable tun/tap inside lxc

To enable the tun/tap interface in a lxc container – eg. for Openvpn – one needs to edit the lxc configuration file.

Its default location for all containers is:


and you have to add:

lxc.cgroup.devices.allow = c 10:200 rwm

This works in Proxmox 4.2, too.

note: be aware that the config file above applies to all lxc container on the host, if you want a more fine grained control edit /etc/pve/lxc/<ID>/<ID>.conf for Proxmox, or /var/lib/lxc/<container>/config for plain lxc.


To actually use a tun/tap device it must be created inside the container on every boot, so add the following to your /etc/rc.local inside your container:

if ! [ -c /dev/net/tun ]; then
 mkdir -p /dev/net
 mknod -m 666 /dev/net/tun c 10 200

thats it!


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.